mediumMultiple SelectObjective-mapped
200-901 Practice Question: Which TWO of the following are recommended…
Which TWO of the following are recommended practices for securing a CI/CD pipeline in a DevOps environment? (Choose two.)
⚠ Common exam trap
Cisco often tests the misconception that security testing can be deferred to post-production (Option C) or that shared credentials simplify management (Option E), but the correct answers emphasize proactive security (scanning early) and credential isolation (vault injection).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store secrets and credentials in a secure vault and inject them at runtime
Storing secrets (e.g., API keys, database passwords) in a secure vault (like HashiCorp Vault or AWS Secrets Manager) and injecting them at runtime prevents hard-coded credentials in source code or configuration files. This follows the principle of least privilege and ensures that secrets are never exposed in logs, version control, or build artifacts, which is a fundamental security practice for CI/CD pipelines.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store secrets and credentials in a secure vault and inject them at runtime
Why this is correct
Keeps secrets out of source code and build logs.
- ✗
Grant all developers write access to the production environment to enable faster fixes
Why it's wrong here
Least privilege should be enforced; only authorized personnel should have production access.
- ✗
Deploy code to production first, then run security tests to check for issues
Why it's wrong here
Security tests should be run before production deployment.
- ✓
Scan container images for known vulnerabilities as part of the build pipeline
Why this is correct
Helps catch vulnerabilities before deployment.
- ✗
Use the same API token for all pipeline stages to simplify authentication
Why it's wrong here
Sharing tokens reduces security; tokens should be scoped per stage.
Go deeper
Related to this question
About these practice questions
This 200-901 question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.